Authentication Bypass Affecting thunderbird-debuginfo package, versions <0:128.10.1-1.amzn2.0.1


Severity

Recommended
0.0
high
0
10

Based on Amazon Linux security rating.

Threat Intelligence

EPSS
0.04% (12th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-AMZN2-THUNDERBIRDDEBUGINFO-10266038
  • published30 May 2025
  • disclosed14 May 2025

Introduced: 14 May 2025

NewCVE-2025-3875  (opens in a new tab)
CWE-290  (opens in a new tab)

How to fix?

Upgrade Amazon-Linux:2 thunderbird-debuginfo to version 0:128.10.1-1.amzn2.0.1 or higher.
This issue was patched in ALAS2-2025-2859.

NVD Description

Note: Versions mentioned in the description apply only to the upstream thunderbird-debuginfo package and not the thunderbird-debuginfo package as distributed by Amazon-Linux. See How to fix? for Amazon-Linux:2 relevant fixed versions and status.

Thunderbird parses addresses in a way that can allow sender spoofing in case the server allows an invalid From address to be used. For example, if the From header contains an (invalid) value "Spoofed Name ", Thunderbird treats spoofed@example.com as the actual address. This vulnerability affects Thunderbird < 128.10.1 and Thunderbird < 138.0.1.

CVSS Base Scores

version 3.1